AMENDMENTS TO THE CLAIMS 

Please aro^idtheclaims as indicated hereafter. 



1 . (Currently Amended) In a terminal of a conditional access system in which a user 
selects a service, the selected service being associated with a frequency, the terminal having a 
tuner and a secure element with at least one authorized entitlement unit number stored therein, a 
method of determining whether the terminal is authorized to receive the selected service, the 
method comprising steps of: 

receiving at least one encrypted entitlement control message corresponding to the 
service , wherein each entitlement control message includes a packet identifier (PIP) and a 
payload : 

decrypting each of the at least one encrypted entitlement control message in the 
secure element, each decrypted entitlement control message revealing at least one first 
entitlement number associated with the selected service , wherein the at least one authorized 
entitlement unit number is carried in the pavload ;-and - - 

determining that the terminal is authorized to receive the selected service when 
any first entitlement number of any decrypted entitlement control message represents any number 
of the at least one authorized entitlement unit number. 

2. (Original) The method of claim 1, further comprising initial steps of: 
receiving over a permanently available link an entitlement unit table associating 

the selected service with at least one second entitlement number; 

tuning the tuner of the terminal to the frequency associated with the selected 
service when any of said at least one second entitlement number represents any number of said at 
least one authorized entitlement unit number. 
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3. (Original) The method of claim 2, wherein the step of receiving over a 
permanently available data link includes receiving the entitlement unit table over an out of band 
data link. 

4. (Original) The method of claim 2, wherein the step of receiving over a 
permanently available link includes receiving the entitlement unit table incorporated in a data 
packet that is included in a data stream associated with an initial power on frequency that is 
tunable by the timer. 

5. (Original) The method of claim 2, wherein the step of receiving over a 
permanently available link includes receiving the entitlement unit table incorporated in a data 
packet that is included in a data stream associated with each frequency that is tunable by the 
tuner. 

- 6. — (Original) The method of claim 1 , wherein the step of decrypting the at least one - 
encrypted entitlement control message includes recovering at least one control word associated 
with decryption of a video component of the selected service. 

7. (Original) The method of claim 1, wherein the step of decrypting the at least one 
encrypted entitlement control message includes recovering at least one control word associated 
with decryption of an audio component of the selected service. 

8. (Original) The method of claim 1, wherein the step of receiving at least one 
encrypted entitlement control message includes demodulating an output of the tuner to recover a 
data component corresponding to the selected service, the data component containing the 
encrypted entitlement control message. 
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9. (Original) The method of claim 1, wherein the step of decrypting said at least one 
encrypted entitlement control message includes recovering at least one control word from said at 
least one decrypted entitlement control message, each control word being a decryption key for 
decrypting a corresponding service component of the selected service. 

10. (Original) The method of claim 9, further comprising steps of: 
recovering a first encrypted service component; and 

decrypting the encrypted service component using a first control word of said at 
least one control word. 

1 1 . (Original) The method of claim 1, further comprising steps of: 

receiving an encrypted entitlement management message addressed to the 

terminal; and 

decrypting the encrypted entitlement management message in the secure element, 
— the decrypted entitlement management message-including an update of at least one authorized 
entitlement unit number to be stored in the secure element. 

12. (Original) The method of claim 11, wherein the step of receiving an encrypted 
entitlement management message includes receiving the encrypted entitlement management 
message over an out of band data link. 

13. (Original) The method of claim 11, wherein the step of receiving an encrypted 
entitlement management message includes receiving the encrypted entitlement management 
message incorporated in a data packet that is included in a data stream associated with each 
frequency that is tunable by the tuner. 
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14} (Original) The method of claim 1, further comprising steps of: 

receiving an entitlement management message addressed to the terminal; and 
authenticating the entitlement management message in the secure element, the 

authenticated entitlement management message including an update of at least one authorized 

entitlement unit number to be stored in the secure element. 

15. (Original) The method of claim 14, wherein the step of receiving an entitlement 
management message includes receiving the entitlement management message over an out of 
band data link. 

16. (Original) The method of claim 14, wherein the step of receiving an entitlement 
management message includes receiving the entitlement management message incorporated in a 
data packet that is included in a data stream associated with each frequency that is tunable by the 
tuner. 
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17. (Currently Amended) In a terminal of a conditional access system in which a user 
selects a service, the selected service being associated with a frequency, the terminal having a 
tuner and a secure element with at least one authorized entitlement unit number stored therein, a 
method of determining whether the terminal is authorized to receive the selected service, the 
method comprising steps of: 

receiving at least one entitlement control message corresponding to the service^ 
wherein each entitlement control message includes a packet identifier (FJD) and a payload : 

authenticating each of the at least one entitlement control message in the secure 
element, each authenticated entitlement control message revealing at least one first entitlement 
number associated with the selected servic e, wherein the at least one authorized entitlement unit 
number is carried in the payload ; and 

determining that the terminal is authorized to receive the selected service when 
any first entitlement number of any authenticated entitlement control message represents any 
number of the at least one authorized entitlement unit number. 

18. (Original) The method of claim 17, further comprising initial steps of: 
receiving over a permanently available link an entitlement unit table associating 

the selected service with at least one second entitlement number; 

tuning the tuner of the terminal to the frequency associated with the selected 
service when any of said at least one second entitlement number represents any number of said at 
least one authorized entitlement unit number. 

19. (Original) The method of claim 18, wherein the step of receiving over a 
permanently available data link includes receiving the entitlement unit table over an out of band 
data link. 
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20. (Original) The method of claim 18, wherein the step of receiving over a 
permanently available link includes receiving the entitlement unit table incorporated in a data 
packet that is included in a data stream associated with an initial power on frequency that is 
tunable by the tuner. 

21. (Original) The method of claim 18, wherein the step of receiving over a 
permanently available link includes receiving the entitlement unit table incorporated in a data 
packet that is included in a data stream associated with each frequency that is tunable by the 
tuner. 

22. (Original) The method of claim 17, wherein the step of authenticating the at least 
one entitlement control message includes recovering at least one control word associated with 
decryption of a video component of the selected service. 

23. (Original) The method of claim 1 7, wherein the step of authenticating the at least 

one entitlement control message includes recovering at least one control word associated with 
decryption of an audio component of the selected service. 

24. (Original) The method of claim 17, wherein the step of receiving at least one 
entitlement control message includes demodulating an output of the tuner to recover a data 
component corresponding to the selected service, the data component containing the entitlement 
control message. 

25. (Original) The method of claim 17, wherein the step of authenticating said at 
least one entitlement control message includes recovering at least one control word from said at 
least one entitlement control message, each control word being a decryption key for decrypting a 
corresponding service component of the selected service. 
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26. (Original) The method of claim 25, further comprising steps of: 
recovering a first encrypted service component; and 

decrypting the encrypted service component using a first control word of said at 
least one control word. 

27. (Original) The method of claim 17, further comprising steps of: 



the decrypted entitlement management message including an update of at least one authorized 
entitlement unit number to be stored in the secure element. 

28. (Original) The method of claim 27, wherein the step of receiving an encrypted 

- entitlement -management-message includes receiving the encrypted entitlement management- 
message over an out of band data link. 

29. (Original) The method of claim 27, wherein the step of receiving an encrypted 
entitlement management message includes receiving the encrypted entitlement management 
message incorporated in a data packet that is included in a data stream associated with each 
frequency that is tunable by the tuner. 

30. (Original) The method of claim 17, further comprising steps of 
receiving an entitlement management message addressed to the terminal; and 
authenticating the entitlement management message in the secure element, the 

authenticated entitlement management message including an update of at least one authorized 
entitlement unit number to be stored in the secure element. 



receiving an encrypted entitlement management message addressed to the 



terminal; and 



decrypting the encrypted entitlement management message in the secure element, 
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31. (Original) The method of claim 30, wherein the step of receiving an entitlement 
management message includes receiving the entitlement management message over an out of 
band data link. 

32. (Original) The method of claim 30, wherein the step of receiving an entitlement 
management message includes receiving the entitlement management message incorporated in a 
data packet that is included in a data stream associated with each frequency that is tunable by the 
tuner. 

33. (Original) Li a terminal of a conditional access system, the terminal including a 
tuner and a selector for selecting a service, the selected service being identified by a 
corresponding service number and frequency, a conditional access apparatus comprising: 

a processor having plural control modules, a first control module controlling the 
processor to receive at least one encrypted entitlement control message corresponding to the 
selected service; and - ~ 

a secure element having at least one authorized entitlement unit number stored 
therein and having plural control modules, a second control module controlling the secure 
element to decrypt each of the at least one encrypted entitlement control message, each decrypted 
entitlement control message revealing at least one first entitlement number associated with the 
selected service, a third control module controlling the secure element to determine that the 
terminal is authorized to receive the selected service when any first entitlement number of any 
decrypted entitlement control message represents any number of the at least one authorized 
entitlement unit number. 
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34. (Original) The apparatus of claim 33, wherein: 

the processor further includes a fourth control module controlling the processor to 
receive over a permanently available link an entitlement unit table associating the selected 
service with at least one second entitlement number; and 

the processor further includes a fifth control module controlling the processor to 
tune the tuner of the terminal to the frequency associated with the selected service when any of 
said at least one second entitlement number represents any number of said at least one authorized 
entitlement unit number. 

35. (Original) The apparatus of claim 34, wherein the fourth control module includes 
a control module to receive the entitlement unit table over an out of band data link. 

36. (Original) The apparatus of claim 34, wherein the fourth control module includes 
a control module to receive the entitlement unit table incorporated in a data packet that is 
included-in a data-stream-associated with an initial power on fi:'equency that is tunable by the 
tuner. 

37. (Original) The apparatus of claim 34, wherein the fourth control module includes 
a control module to receive the entitlement unit table incorporated in a data packet that, is 
included in a data stream associated with each frequency that is tunable by the tuner. 

38. (Previously Amended) The apparatus of claim 33, wherein the second control 
module includes a control module to recover at least one control word associated with decryption 
of a video component of the selected service. 
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39. (Original) The apparatus of claim 33, wherein the second control module 
includes a control module to recover at least one control word associated with decryption of an 
audio component of the selected service. 

40. (Original) The apparatus of claim 33, wherein the first control module includes a 
control module to demodulate an output of the tuner to recover a data component corresponding 
to the selected service, the data component containing the encrypted entitlement control message. 

41. (Original) The apparatus of claim 33, wherein the second control module 
includes a control module to recover at least one control word from said at least one decrypted 
entitlement control message, each control word being a decryption key for decrypting a 
corresponding service component of the selected service. 

42. (Original) The apparatus of claim 41, further comprising: 

a fourth-control module to control the processor to recover a first encrypted- 
service component; and 

a decryptor to decrypt the encrypted service component using a first control word 
of said at least one control word. 

43. (Original) The apparatus of claim 33, further comprising: 

a fourth control module to control the processor to receive an encrypted 
entitlement management message addressed to the terminal; and 

a fifth control module to control the secure element to decrypt the encrypted 
entitlement management message, the decrypted entitlement management message including an 
update of at least one authorized entitlement unit number to be stored in the secure element. 
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44. (Original) The apparatus of claim 43, wherein the fourth control module includes 
a control module to receive the encrypted entitlement management message over an out of band 
data link. 

45. (Original) The apparatus of claim 43, wherein the fourth control module includes 
a control module to receive the encrypted entitlement management message incorporated in a 
data packet that is included in a data stream associated with each frequency that is tunable by the 
tuner. 

46. (Original) The apparatus of claim 33, further comprising: 

a fourth control module to control the processor to receive an entitlement 
management message addressed to the terminal; and 

a fifth control module to control the secure element to authenticate the entitlement 
management message, the authenticated entitlement management message including an update of 
atleast one authorized entitlement unit number to-be stored in the secure element. 

47. (Original) The apparatus of claim 46, wherein the fourth control module includes 
a control module to receive the entitlement management message over an out of band data link. 

48. (Original) The apparatus of claim 46, wherein the fourth control module includes 
a control module to receive the entitlement management message incorporated in a data packet 
that is included in a data stream associated with each frequency that is tunable by the tuner. 
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49. (Original) In a terminal of a conditional access system, the terminal including a 
tuner and a selector for selecting a service, the selected service being identified by a 
corresponding service number and frequency, a conditional access apparatus comprising: 

a processor having plural control modules, a first control module controlling the 
processor to receive at least one entitlement control message corresponding to the selected 
service; and 

a secure element having at least one authorized entitlement unit number stored 
therein and having plural control modules, a second control module controlling the secure 
element to authenticate each of the at least one entitlement control message, each entitlement 
control message revealing at least one first entitlement number associated with the selected 
service, a third control module controlling the secure element to determine that the terminal is 
authorized to receive the selected service when any first entitlement number of any authenticated 
entitlement control message represents any number of the at least one authorized entitlement unit 
number. 



50. (Original) The apparatus of claim 49, wherein: 

the processor further includes a fourth control module controlling the processor to 
receive over a permanently available link an entitlement unit table associating the selected 
service with at least one second entitlement number; and 

the processor further includes a fifth control module controlling the processor to 
tune the tuner of the terminal to the frequency associated with the selected service when any of 
said at least one second entitlement number represents any number of said at least one authorized 
entitlement unit number. 

51. (Original) The apparatus of claim 50, wherein the fourth control module includes 
a control module to receive the entitlement unit table over an out of band data link. 
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52. (Original) The apparatus of claim 50, wherein the fourth control module includes 
a control module to receive the entitlement unit table incorporated in a data packet that is 
included in a data stream associated with an initial power on frequency that is tunable by the 
tuner. 

53. (Original) The apparatus of claim 50, wherein the fourth control module includes 
a control module to receive the entitlement unit table incorporated in a data packet that is 
included in a data stream associated with each frequency that is tunable by the tuner. 

54. (Previously Amended) The apparatus of claim 49, wherein the second control 
module includes a control module to recover at least one control word associated with decryption 
of a video component of the selected service. 

55. (Original) The apparatus of claim 49, wherein the second control module 
-includes a control module to recover at least one control word associated with decryption of an 

audio component of the selected service. 

56. (Original) The apparatus of claim 49, wherein the first control module includes a 
control module to demodulate an output of the tuner to recover a data component corresponding 
to the selected service, the data component containing the entitlement control message. 

57. (Original) The apparatus of claim 49, wherein the second control module 
includes a control module to recover at least one control word from said at least one entitlement 
control message, each control word being a decryption key for decrypting a corresponding 
service component of the selected service. 
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58. (Original) The apparatus of claim 57, further comprising: 

a fourth control module to control the processor to recover a first encrypted 
service component; and 

a decryptor to decrypt the encrypted service component using a first control word 
of said at least one control word. 

59. (Original) The apparatus of claim 49, further comprising: 

a fourth control module to control the processor to receive an encrypted 
entitlement management message addressed to the terminal; and 

a fifth control module to control the secure element to decrypt the encrypted 
entitlement management message, the decrypted entitlement management message including an 
update of at least one authorized entitlement unit number to be stored in the secure element. 

60. (Original) The apparatus of claim 59, wherein the fourth control module includes 
a, control module_to_receive the enciypted entitlement management message over an out-of band 
data link. 

61. (Original) The apparatus of claim 59, wherein the fourth control module includes 
a control module to receive the encrypted entitlement management message incorporated . in a 
data packet that is included in a data stream associated with each frequency that is tunable by the 
tuner. 
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62. (Original) The apparatus of claim 49, further comprising: 

a fourth control module to control the processor to receive an entitlement 
management message addressed to the terminal; and 

a fifth control module to control the secure element to authenticate the entitlement 
management message, the authenticated entitlement management message including an update of 
at least one authorized entitlement unit number to be stored in the secure element. 

63. (Original) The apparatus of claim 62, wherein the fourth control module includes 
a control module to receive the entitlement management message over an out of band data link. 

64. (Original) The apparatus of claim 62, wherein the fourth control module includes 
a control module to receive the entitlement management message incorporated in a data packet 
that is included in a data stream associated with each frequency that is tunable by the tuner. 

65 (New-) A -method of providing a service-in a conditional access system^ the 

method implemented in a terminal and comprising the steps of: 

receiving a stream of packets, the stream of packets including packets comprising 
the service and entitlement control messages (ECMs) for the service; 

determining a first entitlement unit number for the service; 

determining whether the terminal is authorized to access the service based upon 
the first entitlement unit number and an authorized entitlement unit number that is stored in a 
memory of the terminal; and 

responsive to determining the terminal is not authorized, displaying something 
other than the service. 
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66. (New) The method of claim 65, wherein responsive to determining the terminal is 
authorized to access the service further including the steps of: 

parsing ECMs for the service from the stream of packets, wherein each ECM 
includes a second entitlement unit number that is carried in the payload of the ECM; 

confirming that the terminal is authorized to access the service based upon the 
second entitlement unit number and the authorized entitlement unit number; 

responsive to confirming that the terminal is authorized further including the steps 

of: 

recovering control words from the received ECMs; 
decrypting the service using the recovered control words; and 
displaying the service. 

67. (New) The method of claim 66, wherein a user is currently viewing a second 
service, and wherein the something other that is displayed is a third service. 

68. (New) The method of claim 67, wherein the third service is a predetermined 

service. 

69. (New) The method of claim 68, wherein the predetermined service is a barker 

service. 

70. (New) The method of claim 66, wherein a user is currently viewing a second 
service, and wherein the something other that is displayed is a message. 

71. (New) The method of claim 66, wherein the message instructs the user to select 
another service. 
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72. (New) A method of providing a terminal in a conditional access system with 
services, the method comprising the steps of; 

associating services with entitlement unit numbers; 

providing the terminal with an electronic program guide that associates universal 
service identification numbers to services; 

providing the terminal with an entitlement unit table that translates universal 
service identification numbers to entitlement unit numbers; and 

providing the terminal with an authorized entitlement unit number, wherein 
responsive to the a user selecting a given service, the terminal determines whether the terminal is 
authorized to access the given service using the electronic program guide, the entitlement unit 
table, and the authorized entitlement unit number. 

73. (New) The method of claim 72, wherein the authorized entitlement unit number 
is provided to the terminal in an entitlement management message. 



74. (New) The method of claim 72, wherein a given entitlement unit number is 
associated with a pluraUty of services. 

75. (New) The method of claim 72, wherein the terminal is authorized for a first 
group of services, the first group of services having a first entitlement unit number, and further 
including the step of: 

providing the terminal with a second authorized entitlement unit number, wherein 
the second authorized entitlement unit number is associated with a second group of services. 

76. (New) The method of claim 75, wherein the given service is associated with both 
the first authorized entitlement unit number and the second authorized entitlement unit number. 
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77. (New) The method of claim 72, further including the steps of: 
providing the services in a stream of packets; 

multiplexing entitlement control messages for a given service into the stream of 
packets, wherein each entitlement control message includes a second entitlement unit number, 
wherein the terminal confirms that the terminal is authorized to access the given service using the 
second entitlement unit number and the authorized entitlement unit number. 

78. (New) The method of claim 77, wherein the entitlement control messages 
includes a plurality of entitlement unit numbers. 

79. (New) A method of providing a service to a terminal in a conditional access 
system, the method implemented at the terminal and comprising the steps of: 

receiving an electronic program guide that associates universal service 
identification numbers to services; 

rec_eiying_an entitlement unit -table -th universal service identification - 

numbers to entitlement unit numbers; and 

receiving an authorized entitlement unit number; 

receiving user input for a given service; 

determining whether the terminal is authorized to access the given service using 
the electronic program guide, the entitlement unit table, and the authorized entitlement unit 
number. 

80. (New) The method of claim 79, wherein the authorized entitlement unit number 
is carried in an entitlement management message. 

81 . (New) The method of claim 79, further including the step of: 
storing the authorized entitlement unit number in a memory. 
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82. (New) The method of claim 81, wherein the memory is included in a secure 
microprocessor having input/output terminals, and the secure microprocessor is characterized by 
the memory being unobservable at the input/output terminals. 

83. (New) The method of claim 79, responsive to determining that the terminal is 
authorized to access the given service, further including the steps of: 

receiving a stream of packets, the stream of packets including packets comprising 
the given service and entitlement control messages (ECMs) for the given service; 

responsive to determining that the terminal is authorized to access the given 
service, further including the steps of: 

parsing ECMs for the given service from the stream of packets, wherein each 
ECM includes an entitlement unit number that is carried in the payload of the ECM; 

confirming that the terminal is authorized to access the given service based upon 
the entitlement unit number and the authorized entitlement unit number; 

responsive to confirming that.the terminal, is authorized further including the steps — 

of: 

recovering control words from the received ECMs; 

decrypting the given service using the recovered control words; and 

displaying the given service. 

84. (New) The method of claim 83, wherein the entitlement control messages 
includes a plurality of entitlement unit numbers, and the step of confirming that the terminal is 
authorized to access the given service further includes the step of: 

comparing each of entitlement unit numbers with the authorized entitlement unit 
number until one of the entitlement unit numbers matches the authorized entitlement unit 
number, wherein the terminal is authorized to access the given service if there is a match. 
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